On Wednesday, 7 October 2026 18:03:57 CEST George via tor-relays wrote: > On 10/7/26 11:20, Jonathan D. Proulx via tor-relays wrote: >> Thanks for the excellent write up. +1 > > One of our key remediations which you didn't mention was adding > > multifactor authenitcation (MFA) to our ssh, so even if a password or > > key leaks that's no longer sufficient. > > > > Nothing is perfect but MFA seems like a substantial mitigation to the > > typical Ebury vector. > > * protect your private SSH keys as if they're the physical keys to you > residence > * ed25519 is the key type you should use, but with OpenSSH 10.3 you can > start using mldsa44-ed25519, which is apparently post-quantum > cryptanalysis proof: I hope NitroKey and OnlyKey will be able to do that via a firmware upgrade at some point. > And just to be clear, passwd-protected SSH keys is not considered > multi-factor authentication (MFA)... MFA would require another factor > besides "what you have" in the private key. The passwd is just > protecting usage of the private key. MFA would mean Yubikey, TOTP, etc. +1 FIDO/U2F hardware authenticator support was added in OpenSSH version 8.2 ~4 Years ago. Because I know from the last visit by the cops that I only have 1-2 seconds ;-) SSH keys on a PIN-protected and self-destructing OnlyKey.¹ https://gist.github.com/boldsuck/905c2c01e596e5673340216089366b76 ¹(Standard, 6 physical buttons) -- ╰_╯ Ciao Marco! Debian GNU/Linux It's free software and it gives you freedom!
Attachment:
signature.asc
Description: This is a digitally signed message part.
_______________________________________________ tor-relays mailing list -- tor-relays@xxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to tor-relays-leave@xxxxxxxxxxxxxxxxxxxx